I am struggling with strange crontab jobs, I have disabled many time but it comes again and again, any idea what is the root cause of such job and how I resolve it?
VPS - ubuntu 16.04 - firewall enabled
ERPNext: v11.1.35 (master)
Frappe Framework: v11.1.32 (master)
What is the content of the files?
cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync
ubuntu@vps632278:~$ cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync
if test -r /home/frappe/.firefoxcatche/a/bash.pid; then
if $(kill -CHLD $pid >/dev/null 2>&1)
I think you should get rid of those files and the cron entries.
crontab -e #this will allow you to edit the cron file for your user
#remove all the lines that refer to .firefoxcatche
#if you are using nano to edit, Ctrl-k deletes the line you are on. If you are using vi, then press the "d" key twice to delete a line
#Remove the actual files - these start with a dot, so in normal display mode they are "hidden" - which is not a good indication since they don't look like they are config or useful files.
rm --recursive --force /home/frappe/.firefoxcatche
The @reboot forces the scripts to reload even after you have rebooted - also doesn’t seem like a good thing to me, but maybe I am just biased
Done, how I can test that issue resolved, thx a lot
its a crypto mining attack also ???